Distributed SVM-based Multimodal Intrusion Detection Architecture With Incremental Learning And Modality Scalability

Abstract

Multimodal data differ significantly in temporal granularity, structural features, and semantic levels, which leads to difficulties in fusion, weak generalization ability, and low training efficiency. To this end, this paper introduces the Distributed Support Vector Machine (DSVM) architecture to construct modal local models separately, and achieve unified decision-making through support vector aggregation to improve system efficiency, scalability, and adaptability to heterogeneous data. The system first extracts statistical features, keyword features, and time series patterns from network traffic, system logs, and behavior sequences, then uses standardization and PCA (Principal Component Analysis) to reduce the dimension of the features. Then, the different modal data are distributed and mapped to each computing node. The local SVM (Support Vector Machine) model is deployed independently and trained using the SMO (Sequential Minimal Optimization) algorithm, and the boundary distance screens the effective support vector. All local support vectors are uploaded to the DSVM central node, the RBF kernel function is used to reconstruct the global classifier, and the final decision is made through majority voting. In addition, the system designs a modality plug-in mechanism to support the access of new modalities, and realizes rapid model updates and dynamic adjustment of support vectors based on incremental SVM. Experiments show that the DSVM system has superior performance in multimodal data fusion: the classification accuracy is still 88% under severe imbalance (1:20); the accuracy is maintained at 83% when the noise intensity σ=0.4; the fusion training efficiency is significantly improved compared with the centralized SVM. The system has excellent scalability and discrimination boundary stability, which verifies its robustness and engineering practicality.